CVE-2025-66398: Signal K Server RCE Vulnerability

CVE-2025-66398 Overview

Signal K Server is a server application that runs on a central hub in a boat, providing a modern and open data format for marine electronics. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE).

Critical Impact

Unauthenticated attackers can achieve Remote Code Execution by manipulating the server's internal state to overwrite critical configuration files, potentially compromising entire marine vessel control systems.

Affected Products

• Signal K Server versions prior to 2.19.0
• signalk signal_k_server (all platforms)
• Marine vessel systems running vulnerable Signal K Server instances

Discovery Timeline

• 2026-01-01 - CVE-2025-66398 published to NVD
• 2026-01-06 - Last updated in NVD database

Technical Details for CVE-2025-66398

Vulnerability Analysis

This vulnerability represents a critical flaw in the Signal K Server's backup validation mechanism. The server exposes the /skServer/validateBackup endpoint without proper authentication controls, allowing unauthenticated users to manipulate the internal restoreFilePath state variable. This state pollution attack enables an adversary to control where backup restoration operations write files on the system.

When an administrator subsequently uses the legitimate "Restore" functionality, the attacker-controlled file path causes critical server configuration files to be overwritten. Key targets include security.json (containing authentication and authorization settings) and package.json (controlling installed packages and potentially allowing malicious code execution through dependency manipulation).

The attack requires user interaction from an administrator to complete, as the exploitation relies on hijacking the administrator's restore operation. However, the initial state pollution can be performed by any unauthenticated network attacker, making this vulnerability particularly dangerous in shared or exposed network environments typical of marine installations.

Root Cause

The root cause of this vulnerability is improper input validation and lack of authentication on the /skServer/validateBackup endpoint (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The endpoint allows external users to modify internal server state without verifying the requester's identity or authorization level. Additionally, the server fails to properly validate or sanitize the file path parameter, allowing attackers to specify arbitrary file locations for subsequent write operations.

Attack Vector

The attack leverages a network-accessible endpoint that can be reached by any unauthenticated user with network access to the Signal K Server. The attack flow involves:

1. An unauthenticated attacker sends a crafted request to the /skServer/validateBackup endpoint
2. The request pollutes the internal restoreFilePath state variable with an attacker-controlled path
3. The attacker waits for an administrator to use the "Restore" functionality through the legitimate interface
4. When the administrator initiates a restore, the polluted state causes critical files like security.json or package.json to be overwritten
5. The attacker can then achieve account takeover by modifying authentication settings or Remote Code Execution through malicious package dependencies

The vulnerability requires user interaction (administrator triggering restore) but the initial attack vector is completely unauthenticated, making it exploitable from the network without any prior access.

Detection Methods for CVE-2025-66398

Indicators of Compromise

• Unexpected HTTP requests to the /skServer/validateBackup endpoint from unauthorized sources
• Modified timestamps on critical configuration files (security.json, package.json) without corresponding administrator activity
• Unauthorized changes to authentication settings or user accounts in the Signal K Server
• Unexpected package installations or modifications in the server's package.json file

Detection Strategies

• Monitor access logs for requests to /skServer/validateBackup from unauthenticated sessions or unexpected IP addresses
• Implement file integrity monitoring on critical configuration files including security.json and package.json
• Configure network intrusion detection to alert on suspicious patterns targeting Signal K Server endpoints
• Deploy web application firewall rules to detect and block unauthorized backup validation requests

Monitoring Recommendations

• Enable detailed access logging for all Signal K Server API endpoints
• Set up alerts for any modifications to security-related configuration files
• Monitor for unusual network traffic patterns targeting port 3000 (default Signal K Server port) or configured server ports
• Implement baseline behavior analysis for administrator restore operations

How to Mitigate CVE-2025-66398

Immediate Actions Required

• Upgrade Signal K Server to version 2.19.0 or later immediately
• Restrict network access to Signal K Server instances using firewall rules until patching is complete
• Review server configuration files for unauthorized modifications, particularly security.json and package.json
• Audit recent restore operations and validate the integrity of current server configuration

Patch Information

Signal K has released version 2.19.0 which addresses this vulnerability by implementing proper authentication controls on the /skServer/validateBackup endpoint and adding validation to prevent state pollution attacks. The patch is available through the official GitHub SignalK v2.19.0 Release. Additional details can be found in the GitHub Security Advisory GHSA-w3x5-7c4c-66p9.

Workarounds

• Implement network segmentation to prevent unauthorized access to Signal K Server instances from untrusted networks
• Configure reverse proxy or web application firewall to block unauthenticated requests to the /skServer/validateBackup endpoint
• Temporarily disable the backup/restore functionality if it is not required for operations
• Enable additional authentication layers at the network level (VPN, IP whitelisting) for accessing the Signal K Server interface

# Example: Block access to validateBackup endpoint using iptables
# Adjust the port and allowed IP addresses as needed
iptables -A INPUT -p tcp --dport 3000 -m string --string "/skServer/validateBackup" --algo bm -j DROP

# Alternative: Configure nginx reverse proxy to block the endpoint
# Add to nginx server configuration:
# location /skServer/validateBackup {
#     deny all;
#     return 403;
# }